In a networked environment, users have access to resources on the network. Resources, for instance, include nodes (i.e., computer systems), servers, applications, and clusters (i.e., collection of application servers). In order to access these resources, the network uses a security process requiring a user to log onto the network with a user identifier and password. After network verification, the user has access to all the resources on the network.
Management of these resources, however, typically occurs through use of an application server system, such as WebSphere Application Server™, which is in communication with the network. Managing resources includes, for example, stopping and starting a server, tuning a server, reading a log file on a node, and so forth. Before managing resources, however, an application may also require a security process for a user to log into the application. The security process may be the same or similar to the user identifier and password required for logging onto the network. Now, after verification, the user has access to all the resources, which the user may manage in an unfettered manner.
Oftentimes, organizations wish to restrict generalized access to resources on the network to prevent security breaches, such as infiltration and corruption, as well as to ensure proper management, such as configuration, administration, operation, and monitoring of the resources. To restrict access, implementation of additional security processes is necessary. Implementing additional processes requires additional constraints placed on both the user and/or the resource. These additional constraints are collectively termed “fine-grained authorization,” as opposed to the “coarse-grained authorization,” or generalized authorization, described above in terms of verification of user identifier and password.
Prior solutions for restricting, i.e., controlling, access to resources include use of policy-based authorization (“PBA”) systems. PBA is a fine-grained authorization technique that assigns access control policies to a user or group of users for permitted actions on the resources, that is, “permissions.” The permissions may include a variety of actions, such as stopping, starting, reading a log, tuning, or other actions on a particular resource. In addition, each permission is associated with one or more authorized users, who may perform the action. For example, if a PBA grants only configuration of server 1, but not server 2, to user A, then user A may configure server 1, but not server 2; additionally, user A would not have access rights to administrator, monitor or operate either server 1 or server 2. In sum, a PBA is often a file or list comprising one or more users assigned to an action on a resource in the form of (user/group name, resource, action).
Role-based authorization (“RBA”) is another, fine-grained authorization solution for restricting, i.e., controlling, access to resources. RBA assigns users to roles, wherein a role is a collection of actions for performing on resources, or, in PBA terms, a role is a set of permissions. Stated still another way, a role is most easily imagined as a definition of a job at the lowest level of granularity used in the organization. The roles may include a starter of a server, a stopper of a server, a tuner of a server, a modifier of an application, an administrator, and so forth, wherein each role is indicative of a set of permissible actions that the user assigned to the role has on a particular resource. For example, if an RBA grants only a role of configurator to user A for configuring server 1, but not for configuring server 2, then user A may configure server 1, but not server 2; additionally, user A, as configurator, would not have administrator, monitor or operator roles for acting on either server 1 or server 2. Overall, in an RBA control system, the system administrator need only grant or revoke access rights to a role, and group different subjects under a role in order to control the RBA system. In sum, an RBA is a file or list comprising one or more users assigned to a role defining the permissible actions for a resource in the form of (user/group name, role, resource).
Although providing added security, the prior solutions fail to do so with optimized scalability for managing the resources. That is, every resource using conventional PBA or RBA systems require each resource to have its own roles or policies with the likely structure including individual files for each resource, wherein the files fail to consider similarities in management authority and/or resources subject to a user's management authority. An individual file structure for each resource can quickly become a scalability nightmare for organizations having thousands of users. For instance, if there are a thousand resources, and, for sake of simplicity, assuming one role or one policy for each resource, then there are a thousand roles or a thousand policies for a given user. As a result of the un-optimized security system, another failure of the prior solutions is borne out: a relatively, high storage requirement for storing the many roles or policies for each user.
A need, therefore, exists, for methods, devices, systems, and media to provide for fine-grained authorization of administrative resources that optimizes scalability that also results in reducing storage requirements for implementation of the security system.